You closed the warning. You ran a virus scan and it found nothing. The "your PC is infected" popup came back anyway. That pattern has one usual cause, and it isn't a virus: some website has your permission to send notifications. Here is how to find it and turn it off, browser by browser.
Short answer: a fake virus popup that survives a scan is almost always a browser notification. Antivirus software scans files and programs; a notification permission is a browser setting, so the scan never touches it. Remove the site from your browser's notification list (steps below) and the popups stop.
"Fake virus popup" covers three different things, and each one is removed differently. Look at where the warning appears:
That is a notification, sent through Windows, macOS or Android by your browser. Look at the small print on it: it names the browser (Google Chrome, Microsoft Edge, Firefox) and a website address, often something meaningless like news-xyz123.cc. That address is the site to remove. These keep arriving even when no scam page is open, and sometimes when the browser itself is closed. Go to the notification steps.
That is a scam web page, usually reached through a bad ad or a redirect. It may go fullscreen, play a voice, show a fake Windows Defender or Apple screen and refuse to close. It can't scan anything: the "5 viruses found" text is the same on every visitor's screen. Close it this way, and don't call the number.
That points to a browser extension that is redirecting you. Check your extensions.
On an iPhone or iPad the usual culprit is different again: calendar spam.
Don't click anything inside the page, including its "Close", "Cancel" or "X" buttons, which are part of the page and can start a download.
When you reopen the browser and it offers to restore your tabs, say no, or the page comes straight back. Then clear the last hour of browsing history and cached files (Ctrl+Shift+Delete) so the address doesn't autocomplete when you type.
No real company puts a support number in a browser warning. Microsoft's, Apple's and your antivirus vendor's real alerts appear in the operating system, not in a web page, and never ask you to call. The number on the page connects to a call centre that will try to get remote access to your computer and then charge you to "fix" it.
This is the step that stops a popup coming back. You are looking for a list of sites that are allowed to send notifications. Remove every site you don't recognise. If you're not sure, remove them all: a site you actually want will ask again.
Type chrome://settings/content/notifications into the address bar and press Enter. (The long way: Settings → Privacy and security → Site settings → Notifications.) Under Allowed to send notifications, click the three dots next to each unwanted site and choose Remove.
Type edge://settings/content/notifications into the address bar. Under Allow, click the three dots next to each unwanted site and choose Remove.
Type about:preferences#privacy into the address bar, scroll to Permissions and click Settings… next to Notifications. Select the site, click Remove Website, then Save Changes.
Open Safari, then Safari → Settings (Preferences on older macOS) → Websites → Notifications. Select each unwanted site and click Remove, or set it to Deny.
Open Chrome, tap the three dots → Settings → Site settings → Notifications, tap the site and turn its notifications off. Quicker: press and hold the notification itself when it next appears and use the settings it offers to switch that site off.
On Windows, the three-dot menu on a notification also offers to turn off all notifications from that browser. It works as a stopgap, but it silences sites you want too, and the permission is still there; remove the site as well.
Safari on an iPhone doesn't let ordinary websites send notifications, so "your iPhone is infected" alerts there usually arrive another way: as calendar events. Tapping "OK" on a scam page at some point subscribed you to a calendar that fills your days with fake warnings and links.
Go to Settings → Calendar → Accounts (on iOS 18: Settings → Apps → Calendar → Calendar Accounts) → Subscribed Calendars. Tap the one you don't recognise and choose Delete Account. The events disappear with it.
If new tabs open by themselves, or your homepage or search engine changed without you doing it, look at your extensions: chrome://extensions in Chrome, edge://extensions in Edge, about:addons in Firefox. Remove anything you don't remember installing, especially recent additions with generic names ("PDF Converter", "Video Downloader", "Safe Search"). Extensions bundled with free downloads are the usual way in.
If the redirects survive that, reset the browser. In Chrome and Edge it is under Settings → Reset settings; in Firefox, Help → More troubleshooting information → Refresh Firefox. Bookmarks and saved passwords are kept; extensions and site permissions are cleared.
Because there was nothing on the computer to find. A notification permission is one line in your browser's settings saying "this site may show messages". Nothing is installed, so Windows Security, Malwarebytes or any other scanner reports the machine as clean, correctly. The scan is only the right tool if you downloaded and ran something the scam page offered; in that case run a full scan as well.
Switch notification prompts off by default. Almost nobody needs a random website's notifications, and turning off the prompt removes the whole trick.
chrome://settings/content/notifications page, choose Don't allow sites to send notifications.edge://settings/content/notifications, turn off Ask before sending.Treat "click Allow to continue" as a red flag. Pages that say "Click Allow to prove you're not a robot" or "to watch the video" are asking for notification permission, not checking anything. Here is how that trick works.
Block malicious ads. Most people reach a fake virus page through an ad on an ordinary site. A content blocker such as uBlock Origin (uBlock Origin Lite on Chrome) removes most of that route.
What PhishClean does here, honestly. PhishClean is built mainly for login and payment pages, and it does not block notification prompts; the browser setting above does that best. Version 1.5.0 (October 2026) added two checks that help with this kind of scam: a warning when a page poses as a virus alert and tells you to call a support number, and a block on sites from a list of about 380,000 reported phishing hosts. Both run on your device; the pages you visit are not sent to us.
If you only saw the page and closed it, nothing happened. If you went further, work through what applies, starting now:
Expect a follow-up: scammers often call back weeks later offering a "refund" for the bogus repair, which is a second scam. For a fuller checklist, see what to do after clicking a phishing link.
Why do I keep getting fake virus popups after a virus scan?
Because the popups come from a website you once allowed to send notifications, not from anything installed on your computer. Antivirus scans look at files and programs, so they find nothing. Open your browser's notification settings (chrome://settings/content/notifications in Chrome, edge://settings/content/notifications in Edge) and remove the sites you don't recognise.
Can a fake virus popup infect my computer?
The page on its own can't. It becomes dangerous when you act on it: downloading the "cleaner" it offers, calling the number, or letting someone connect to your computer. Close it without clicking anything inside it.
Is a Windows Defender warning in my browser real?
No. Windows Security shows its alerts in the Windows notification area and its own app, never inside a browser tab, and it never asks you to call a phone number. A Defender-branded warning in a web page is a scam page.
How do I tell which site is sending the popups?
Read the small print on the notification itself: it names the browser and the website address that sent it. That is the site to remove from the browser's notification list.
My iPhone says it has a virus. What do I do?
On an iPhone these alerts are usually events from a spam calendar you were tricked into subscribing to. Go to Settings, Calendar, Accounts (on iOS 18, Settings, Apps, Calendar, Calendar Accounts), open Subscribed Calendars and delete the one you don't recognise.
PhishClean warns before you type a password or card number into a fake page. All checks run on your device, free for 7 days with no account.
Install PhishCleanLast updated:
If this helped, share it with someone who would benefit from it, or subscribe for new browser-security guides from PhishClean.
Get practical phishing and browser-safety articles in your inbox. No salesy drip, just new guides and product updates when they are worth sending.